AI analysis
Thelia 2.6.1, an open-source PHP e-commerce platform, contains an absolute path traversal flaw in its Smarty template handling. The checkTemplate() validation blocks relative traversal sequences like '../' but fails to reject absolute filesystem paths, so an authorized user can point the template engine at an arbitrary file. Because Smarty compiles templates without an effective security policy, code in the referenced file may be executed with the web server's privileges, yielding server-side template injection and remote code execution. Deployments running Thelia 2.6.1 (and 2.6.0 per related advisory VU#162329) with authenticated back-office users are affected. No public PoC or known in-the-wild exploitation has been reported.
What to do: Upgrade to the latest Thelia release once a fixed version is published (2.6.0 and 2.6.1 are affected per VU#162329). Restrict back-office accounts and file/template-related privileges to trusted administrators, and harden the web server (dedicated low-privilege user, restricted filesystem read scope) to limit the impact of template compilation. Monitor for suspicious absolute paths in template parameters and unexpected files in Smarty compile directories.
Estimated exposure
nicheunknown; plausibly low thousands of self-hosted Thelia stores — Thelia is a self-hosted, primarily French-market open-source e-commerce CMS with no public active-install or exposed-host counts available in this data, so exposure cannot be reliably estimated.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges.